CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107301 MEDIUM · 6.5 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the…
- CVE-2026-107300 HIGH · 7.5 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value…
- CVE-2026-107299 MEDIUM · 5.9 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete…
- CVE-2026-107298 MEDIUM · 5.3 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing…
- CVE-2026-107297 MEDIUM · 5.9 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or map from the…
- CVE-2026-107296 LOW · 3.7 msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in…
- CVE-2026-107295 HIGH · 7.6 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai… Pydantic
- CVE-2026-107294 MEDIUM · 6.5 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local… Pydantic
- CVE-2026-107293 MEDIUM · 5.3 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with… Pydantic
- CVE-2026-107292 MEDIUM · 6.4 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development… Pydantic
- CVE-2026-107291 MEDIUM · 4.3 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with… Pydantic
- CVE-2026-107290 MEDIUM · 6.5 Pydantic AI is een Python-agentraamwerk voor het bouwen van applicaties en workflows met Generatieve AI. Van 1.77.0 tot 1.107.6 en 2.44.0, de lokale web_fetch_tool en… Pydantic
- CVE-2026-105436 HIGH · 8.8 Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
- CVE-2026-104078 HIGH · 7.8 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding…
- CVE-2026-104077 HIGH · 7.8 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute,…
- CVE-2026-95208 NONE Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that…
- CVE-2026-19585 MEDIUM · 5.3 HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files…
- CVE-2026-107678 MEDIUM · 4.7 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers… Ffmpeg
- CVE-2026-107677 MEDIUM · 4.7 FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty… Ffmpeg
- CVE-2026-107676 LOW · 3.3 FFmpeg tot en met 9.0.2 bevat een niet-geïnitialiseerde kwetsbaarheid voor geheugenonthulling in av_dynamic_hdr_plus_to_t35() die maximaal drie payload-bytes ongeïnitialiseerd laat wanneer tone_mapping_flag 0 is. Aanvallers kunnen… Ffmpeg
- CVE-2026-107675 MEDIUM · 5.9 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers… Ffmpeg
- CVE-2026-107660 MEDIUM · 4.8 FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network… Ffmpeg
- CVE-2026-107289 MEDIUM · 6.8 Pydantic AI is een Python-agentraamwerk voor het bouwen van applicaties en workflows met Generatieve AI. Van 1.56.0 tot 1.107.6 en 2.44.0 kunnen toepassingen die door… Pydantic
- CVE-2026-107288 LOW · 3.7 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and… Pydantic
- CVE-2026-107287 MEDIUM · 6.5 Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and… Pydantic
- CVE-2026-106177 MEDIUM · 6.4 A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released…
- CVE-2026-9209 CRITICAL · 9.8 mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied…
- CVE-2026-95125 NONE libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause…
- CVE-2026-93034 CRITICAL · 9.8 SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or…
- CVE-2026-93017 HIGH · 7.7 The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore,…
- CVE-2026-14999 HIGH · 7.4 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by… Ibm
- CVE-2026-14992 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow. Ibm
- CVE-2026-14988 MEDIUM · 6.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow. Ibm
- CVE-2026-14905 HIGH · 8.2 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE)…
- CVE-2026-14888 HIGH · 8.1 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code… Ibm
- CVE-2026-14509 MEDIUM · 5.9 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-14508 MEDIUM · 6.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial… Ibm
- CVE-2026-14507 HIGH · 7.7 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key… Ibm
- CVE-2026-14502 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access… Ibm
- CVE-2026-14497 HIGH · 8.1 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security… Ibm
- CVE-2026-14496 HIGH · 8.2 IBM DataPower Gateway 10.5.0.0 tot en met 10.5.0.22, 10.6.1 tot en met 10.6.6, 10.6.0.0 tot en met 10.6.0.10 en 11.0.0.0 tot en met 11.0.0.2 kunnen… Ibm
- CVE-2026-14273 MEDIUM · 6.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information… Ibm
- CVE-2026-14269 CRITICAL · 9.8 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by… Ibm
- CVE-2026-13258 MEDIUM · 5.4 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an… Ibm
- CVE-2026-13257 MEDIUM · 6.5 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests… Ibm
- CVE-2026-12859 MEDIUM · 6.5 Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS…
- CVE-2026-107640 CRITICAL · 9.1 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter.…
- CVE-2026-107639 HIGH · 8.8 ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert…
- CVE-2026-107638 MEDIUM · 6.8 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP…
- CVE-2026-107637 MEDIUM · 4.3 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other…